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Abstract — We consider a model with three termi- 
nals and examine the problem of characterizing the 
largest rates at which two pairs of terminals can si- 
multaneously generate private keys, each of which is 
effectively concealed from the remaining terminal. 

I. Introduction 

Suppose that terminals X, y and Z observe, respectively, 
the distinct components of a discrete memoryless multiple 
source, i.e., i.i.d. repetitions of the random variables (rvs) 
X, Y, Z, respectively. The terminals are permitted unre- 
stricted communication among themselves over a public chan- 
nel, and all the transmissions are observed by all the terminals. 
An eavesdropper has access to this public communication but 
gathers no additional side information; also, the eavesdropper 
is passive, i.e., unable to corrupt the transmissions. Terminals 
X and y (resp. X and Z) generate a "private key" (PK) with 
the possible help of terminal Z (resp. y) which is concealed 
from the helper terminal Z (resp. y) and from an eaves- 
dropper with access to the public communication among the 
terminals. Our main technical results are single-letter outer 
and inner bounds for the PK-capacity region. Further, under 
certain special conditions, for instance if the correlation of Y 
and Z is deterministic (i.e., there exists a common function 
of Y and Z which renders them conditionally independent), 
these bounds coincide to yield the PK-capacity region. 

II. Statement of Results 

Consider a discrete memoryless multiple source (DMMS) 
with three components corresponding to generic rvs X, Y, 
Z with finite alphabets X, y, Z. Let X" = (Xi, • • • ,X n ), 
Y" = (Yi,... ,Y n ), Z n = (Z x ,.-. ,Z n ) be n i.i.d. repeti- 
tions of the rvs X, Y, Z. The terminals X, y, Z respec- 
tively observe the components X", Y n , Z" of the DMMS 
(X n ,Y n ,Z n ), where n denotes the observation length. The 
terminals can communicate with each other through broad- 
casts over a noiseless public channel, possibly interactively 
in many rounds. Following PQ, we assume without loss of 
generality that these transmissions occur in consecutive time 
slots in r rounds; the communication is depicted by 3r rvs 
F\, ■ ■ ■ , F^r, where Ft denotes the transmission in time slot t, 
1 < t < 3r, by a terminal assigned an index i = t mod 3, 
1 < i < 3, with terminals X, y, Z corresponding to indices 
1, 2, 3, respectively. In general, F t is allowed to be any func- 
tion, defined in terms of a mapping ft, of the observations at 
the terminal with index i and of the previous transmissions 
F' -1 = (Fx, ■ • ■ , Ft-i). Let F denote collectively all the trans- 
missions. Randomization at the terminals is not permitted. 

The rvs Kxy, Lxy represent an e-private key (e-PK) for 
the terminals X and y which is private from the helper ter- 
minal Z, achievable with communication F, if Kxy and Lxy 


are functions of the data available at terminals X and y, re- 
spectively, i.e., Kxy = K X y(X n ,F), L X y = L xy (Y n ,F); 
Kxy and Lxy take values in the same finite set Kxy with 
Pr{Kxy 7^ Lxy} < s; Kxy (or Lxy) satisfies the secrecy 
condition ^I(Kxy A F,Z n ) < e; and Kxy (or Lxy) satis- 
fies the uniformity condition -^H(Kxy) > ^\°g\Kxy\ — £■ 
We are interested in the simultaneous generation of individual 
PK pairs (Kxy, Kxz) as above. 

A pair of numbers (Rxy, Rxz) is an achievable PK-rate 


pair if e„-PK pairs (K 
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,(n). 


xy> F^xzJ 


are achievable with suit- 


able communication, such that e n — > 0, —H(Kxy) ~ * Rxy, 
\H{K { xl) -> Rxz. The set of all achievable PK-rate pairs is 
the PK-capacity region Cpk- 

Our main results for the PK-capacity region are the follow- 
ing. 

Theorem 1 (Outer bound for Cpk)- Let (Rxy, Rxz) be 
an achievable PK-rate pair. Then 


Rxz <I(X AZ\Y), (1) 
I(UAX). 


Rxy <I(XAY\Z), 
Rxy+Rxz < I(XAY, Z) — 

U: U^Y^XZ, U^Z^XY 

Theorem 2 (Inner bound for Cpk)'- The PK-capacity re- 
gion Cpk is inner-bounded by the convex hull of the regions 


max 

-xz, u- 


(Rxy, Rxz) 


< Rxy < I(X A Y\U, 
< Rxz < I(X A Z\Y) 
Rxy + Rxz < I(X A Y, Z) 


.nss(Y), Z), 

I(U mss ry) A X) 


and 


f (Rxy, Rxz): < Rxy < I(X AY\Z), 

1 0<Rxz <I(X AZ\V mas{z) ,Y), 

{ Rxy + Rxz < I(X AY, Z) — I(V msa{z) A X) 

where U mss (Y) (resp. V mss (z)) is the minimal sufficient statis- 
tic for Y (resp. Z) w.r.t. Z (resp. Y). 

Theorem 3: If there exists a rv U such that 


U - 


Y - 


XZ, 


u- 


XY, 


Y 


li- 


the PK-capacity region equals the set of pairs (Rxy 
which satisfy Q and 

Rxy + Rxz < I(X AY,Z)~ maxI(U A X), 


Z, (2) 
Rxz) 


where the maximum is w.r.t. U satisfying 

Theorem 4: If Y and Z are deterministically correlated, 
the PK-capacity region Cpk equals the set of pairs (Rxy, 
Rxz) which satisfy Q and 

Rxy + Rxz < I(X A Y, Z) - I(U mcf A X), 

where U mc f is the maximal common function of Y and Z. 
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